Does Calix B6 module really accept SSH Keys?

[plusiv]

I was trying to use the Calix B6 module and I faced an SSH connection issue.

I tried a simple code like the following:

from netmiko import ConnectHandler

config = {
    'device_type': 'calix_b6',
    'ip': 'calix-olt.lab.local',
    'username': 'my-user',
    'password': 'my-pass',
    'use_keys': False
    }

conn = ConnectHandler(**config)

And I got the following error:

Traceback (most recent call last):
  File "/****/****/ansible/ansible-venv/lib/python3.8/site-packages/netmiko/base_connection.py", line 935, in establish_connection
    self.remote_conn_pre.connect(**ssh_connect_params)
  File "/****/****/ansible/ansible-venv/lib/python3.8/site-packages/paramiko/client.py", line 435, in connect
    self._auth(
  File "/****/****/ansible/ansible-venv/lib/python3.8/site-packages/netmiko/calix/calix_b6.py", line 14, in _auth
    self._transport.auth_none(username)
  File "/****/****/ansible/ansible-venv/lib/python3.8/site-packages/paramiko/transport.py", line 1446, in auth_none
    return self.auth_handler.wait_for_response(my_event)
  File "/****/****/ansible/ansible-venv/lib/python3.8/site-packages/paramiko/auth_handler.py", line 250, in wait_for_response
    raise e
paramiko.ssh_exception.BadAuthenticationType: Bad authentication type; allowed types: ['password']

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "calix_b6_.py", line 11, in <module>
    conn = ConnectHandler(**config)
  File "/****/****/ansible/ansible-venv/lib/python3.8/site-packages/netmiko/ssh_dispatcher.py", line 326, in ConnectHandler
    return ConnectionClass(*args, **kwargs)
  File "/****/****/ansible/ansible-venv/lib/python3.8/site-packages/netmiko/calix/calix_b6.py", line 24, in __init__
    super().__init__(*args, **kwargs)
  File "/****/****/ansible/ansible-venv/lib/python3.8/site-packages/netmiko/base_connection.py", line 350, in __init__
    self._open()
  File "/****/****/ansible/ansible-venv/lib/python3.8/site-packages/netmiko/base_connection.py", line 355, in _open
    self.establish_connection()
  File "/****/****/ansible/ansible-venv/lib/python3.8/site-packages/netmiko/base_connection.py", line 972, in establish_connection
    raise NetmikoAuthenticationException(msg)
netmiko.ssh_exception.NetmikoAuthenticationException: Authentication to device failed.

Common causes of this problem are:
1. Invalid username and password
2. Incorrect SSH-key file
3. Connecting to the wrong device

Device settings: calix_b6 calix-olt.lab.local:22


Bad authentication type; allowed types: ['password']

When I go into the Calix B6 classes, I realized that CalixB6SSH class is doing an overriding of the method _build_ssh_client.

class CalixB6SSH(CalixB6Base):
    """Calix B6 SSH Driver.

    To make it work, we have to override the SSHClient _auth method and manually handle
    the username/password.
    """

    def _build_ssh_client(self):
        """Prepare for Paramiko SSH connection."""
        # Create instance of SSHClient object
        # If not using SSH keys, we use noauth
        if not self.use_keys:
            remote_conn_pre = SSHClient_noauth()
        else:
            remote_conn_pre = SSHClient()

        # Load host_keys for better SSH security
        if self.system_host_keys:
            remote_conn_pre.load_system_host_keys()
        if self.alt_host_keys and path.isfile(self.alt_key_file):
            remote_conn_pre.load_host_keys(self.alt_key_file)

        # Default is to automatically add untrusted hosts (make sure appropriate for your env)
        remote_conn_pre.set_missing_host_key_policy(self.key_policy)
        return remote_conn_pre

The problem with this code is the attribute self.use_keys is not making sure SSH Keys are used, instead, it's causing the connection to be rejected for devices without SSH Keys configured.

This class supports manually handling authentication, but it has to be developed by the user in order to properly work and, also this is the class that is used to connect (SSHClient_noauth) in the case of setting use_keys to False in the config dictionary.

Note that setting use_keys to False in the config dictionary won't force the connection to establish an ssh connection with SSH Key exchange.

My suggestion is to remove this overridden method and, use the CalixB6Base instead of CalixB6SSH.

[ktbyers]

@Jorgmassih Calix B6 at least for some subset of devices used to require that Netmiko manually handle the authentication. See the Calix B6 driver and the special_login_handler method. This is the reason for the SSHClient_noauth().

Calix B6 used to present the following (which Netmiko would have to programmatically handle):

        Calix B6 presents with the following on login:

        login as:
        Password: ****

Is that no longer the case? Or not the case for some subset of Calix B6 devices?

[plusiv]

@ktbyers Apologize to me for taking too long to respond, I have been a little busy. Nowadays, I don't have the Calix B6 device to confirm that, but I have a Calix E7 instead, which has a very similar syntax and authentication method but the Config Mode (it's not present at all in Calix E7), actually I use the Calix B6 module for my Calix E7, but setting the use_keys to True (even without any key) and config_mode to False.

If the manual authentication is no longer the case for Calix B6, the CalixB6Base class should be enough and It would be compatible with other Calix Devices, otherwise, I'm planning to submit a Pull Request for Calix E7 without the CalixB6SSH class for authentication.

[ktbyers]

Yeah, we probably should make a separate driver for Calix E7 until we get more definitive answer on CalixB6 (i.e. someone that has that category of devices and can test it).

[anddaley]

I too am anxiously awaiting support for Calix E7 devices.

[anddaley]

I work for an ISP and we have several Calix E7 nodes and would love if there could be a separate driver for Calix E7.